Retention Policy Author: The Executive Team Member with Responsibility for Data Protection and GDPR Review date: December 2019

Transcription

1 Retention Policy Author: The Executive Team Member with Responsibility for Data Protection and GDPR Review date: December 2019 Last Update Status: Approved 23 May 2018

2 1 POLICY 1.1 Harlow College (the "College") must, in respect of its processing of personal data, comply with the Data Protection Act 2018, the General Data Protection Regulation 2016/679, and related legislation (together, "Data Protection Laws"). 1.2 This Retention Policy should be read in conjunction with the College s Data Protection Policy, which sets out the College s overall approach to data protection matters and sets out the rationale for why a Retention Policy is required for personal data. 1.3 The College is under a legal obligation only to keep personal data for as long as the College needs it. Once the College no longer needs personal data, the College must securely delete it. The College recognises that the correct and lawful treatment of data will maintain confidence in the College and will provide for a successful working environment. 1.4 This Policy applies to all College employees, consultants, contractors and temporary personnel hired to work on behalf of the College ("College Personnel"). 1.5 All College Personnel with access to personal data must comply with this Retention Policy. 1.6 Please read this Retention Policy carefully. All College Personnel must comply with it at all times. If you have any queries regarding this Retention Policy, please consult your manager and/ or the Data Protection Officer. You are advised that any breach of this Retention Policy will be treated seriously and may result in disciplinary action being taken against you. 1.7 College Personnel will receive a copy of this Policy when they start and may receive periodic revisions of this Policy. This Policy does not form part of any College Personnel s contract of and the College reserves the right to change this Policy at any time. All College Personnel are obliged to comply with this Policy at all times. 2 ABOUT THIS POLICY This Retention Policy explains how the College complies with our legal obligation not to keep personal data for longer than we need it and sets out when different types of personal data will be deleted. In particular, it sets out details of the College s policies for the retention of Special Category personal data. 3 DATA RETENTION PERIODS 3.1 The College has assessed the types of personal data that the College holds and the purposes the College use it for. The table below sets out the retention periods that the College has set for the different departments within the College, and the different types of data that they each hold. 3.2 Where years are stated below this refers to academic year not including the current year. For example in data with a retention period of from 2017/18 academic year would be destroyed after the 31st July 2025 (end of 2024/25). 3.3 If any member of College Personnel considers that a particular piece of personal data needs to be kept for more or less time than the period set out in this policy, please contact the Data Protection Officer for guidance. 4 RETENTION PERIODS FOR DIFFERENT CATEGORIES OF DATA Staff Recruitment and selection job application form and all Last action on application + maximum of 1 aspects of recruitment and selection Year Speculative job applications and CVs Last action on application + maximum of 1 Year Statistical information on profile of job applicants 5 Years 2

3 Personal details Overtime records Bank account details Evidence of right to work in the UK DBS information, list 99 and prohibition orders Car insurance details Records of consent to abide by college policies Requests for references Attachment of earning deductions Certificates, qualification correspondence Register of interests Training and CPD records including development requests Performance appraisal forms and correspondence Disciplinary outcomes Discipline case files Staff records of an investigation that has a significant element of an allegation or report of abuse Grievance case files Restructure and redundancy processes Settlement agreements, COT3 and tribunal correspondence Performance management case files Lesson observation assessment data Job evaluation assessments and pay reviews Medical Insurance cover Trade Union correspondence Subject Access and Freedom of Information requests Staff Accessible Parking records In line with Policy /last action on file Last action + 50 Years /last action on file /last action on file /last action on file /last action on file /last action on file /last action on file /last action on file /last action on file 2 years following last action unless longer retention requirements apply (i.e. H&S, Employment Law) /last action on file Health and Safety Accident records Staff Health and safety records (i.e. PEEPs/Maternity risk assessment) Student Health and safety records (i.e. PEEPs/Maternity risk assessment) 3 years At end of academic year in which the programme ends. 3

4 Financial Management Finance System record (Accounts Payable, Accounts Receivable & General Ledger) Bursary (Discretionary support) applications Harlow College Bank account Supplier and customer correspondence Student Records MIS student record Skills action plan - NCS Enrolment form Application form Interview sheet Open accounts record Bursary application Copies of certificates Pro-Monitor Team tracking One-File Disciplinary record (with no Safeguarding elements) Student Disciplinary records of an investigation that has a significant element of an allegation or report of abuse EHCP / One Plan Student Accessible & Motor Cycle Parking records Learners portfolios and course work Internal verification documentation, along with the assessment tracking and feedback Projects Last action + 50 Years 12 weeks after receipt of certification 3 Years after certification Stated in the individual contracts if greater that the retention period stated above. Child Protection Safeguarding record (Risk factors recorded for students) after student has left college Child Protection file if student completes at college and Retain until student s 26 th birthday or 7 does not move to another provider years whichever is greater Receipt of Child Protection file if student moves to Retain until student s 26 th birthday or 7 another provider and record is sent on as required by years whichever is greater law CSE records Indefinitely Child In Need and social care interventions Retain until student s 26 th birthday or 7 years whichever is greater Property CCTV Maximum of 31 days unless part of an investigation 4

5 Governance Governors records including contact details, register of interest and payments, photos & videos Minutes of meetings of the Corporation and its Committees, containing names of attendees 6 years after the year in which the person ceases to be a governor 100 years Administrative Enquiries s Enquiries mailing lists Complaints Refunds details (non-financial) Student Disciplinary records of an investigation that have a significant element of an allegation or report of abuse s 2 Years 1 Year 2 Years 1 Year Last action + 50 Years 2 Years There may be instances that require data to be retained longer than the stated period above. These exceptions will only be applied if they are legislative, funding or contractual requirements. These will be considered in this schedule on it annul review. 5 CHANGES TO THIS POLICY The College reserves the right to change this policy at any time. 5

6 Date Approved: 23 May 2018 TRACKING and REFERENCE INFORMATION Next Review Date: December 2019 (or as required) Author/Responsibility: Executive Team Member Principal with Responsibility for Data Protection and GDPR Equality Impact Assessment: N/A List of related policies, procedures and other documents: Complaints Procedure Equality & Diversity Policy Equality and Diversity Scheme Data Protection Policy Safeguarding Policy Complaints: If you wish to submit a complaint about the application of this policy or the procedure of it, please send your request in accordance with the provisions of the Grievance Procedure. Monitoring: The application of this policy and associated procedure will be monitored by Executive Team Member Principal with Responsibility for Data Protection and GDPR. Easy reading: To receive this policy/procedure in a different format, please contact: HR Services 6